We find that some of the firms we review haven’t performed a regular review of the adequacy and effectiveness of their policies, controls and procedures.
Why is it important?
The regulations say that firms must establish an independent audit function to assess the adequacy and effectiveness of the firm’s AML policies, controls and procedures. Sole practitioners with no employees are exempt from this requirement. Firms should plan to regularly review their AML policies, controls, and procedures. It doesn’t need to be an external review, but firms should design this to be as independent as possible, given the size and nature of the firm. Where firms identify any gaps or weaknesses, they should document how they intend to address them.